ID PASS - Smart card based decentralized identity solution

ID PASS is a secure, privacy respecting identity solution designed specifically for the needs of vulnerable populations.

For the last 5 years, Newlogic, the company behind ID PASS, helped develop and maintain the beneficiary management platform of one of the world’s largest humanitarian organizations. We created its mobile registration component to support door-to-door registrations in the mountainous and landslide-prone areas of Nepal right after the 2015 earthquake. This system supports registrations in the most distressed places on Earth and some of the largest refugee camps located in Africa, Asia, and the Middle East. During this time, we have helped register more than 10 million people, with thousands of new people still being enrolled every day.

Strong of this experience, and having encountered the various systems used in the field by the humanitarian actors, we identified the need for a digital identity solution that is affordable, secure, privacy respecting, and sufficiently versatile to support a wide range of use cases, such as eWallet, school attendance tracking, health records, microfinance and nutrition programmes.

ID PASS is a smart card based decentralized identity solution designed to enhance security and inclusiveness while empowering every individual to own and control their identity. Today, over one billion invisible people are unable to prove and claim ownership over their identity, preventing them from accessing basic rights and services such as health care, citizenship, education, banking, insurance, and many more.

Our team understands that the individuals we want to help may not have access to a smartphone, internet, or even electricity. With this in mind, we designed our solution to be as inclusive and secure as possible while enabling offline use. The card holders are in control of their identity since all Personally Identifiable Information are protected behind a biometric authentication step enforced by their own smart card (i.e. match-on-card).

We chose to make ID PASS open source and built it around open standards and APIs that integrate with existing systems such as beneficiary and identity management platforms. This has been achieved through W3C standards such as Decentralized Identifiers and Verifiable Credentials.

The ID PASS card is extensible and versatile as it comes with a multi-persona solution which allows users to store multiple identities from distinct issuers with different access rights. ID PASS will be a stepping stone to promote collaboration between organizations while protecting the beneficiaries’ right to privacy.

Most modern and privacy respecting digital identity solutions require the use of a smartphone, however, by 2021, it is estimated that only 40% of the world’s population will own one. For this reason, we are using a smart card as an alternative to mobile phones with the same decentralized identity standards. Furthermore, our project won the first prize of $100,000 USD at the EOS Global Hackathon in Hong Kong and has been acknowledged for its innovative use of technology.

Key features of ID PASS:

Does not leave any metadata trail

• As there is no central identity server used, the verifier does not need to connect to a server when validating the identity.

• A Blockchain is used as a Decentralized Public Key Infrastructure but does not store any claim, biometric data or Personally Identifiable Information (PII).

• The verifier can trust the data provided by verifying the digital signature and biometrics which can be done offline.

Secured credential documents

• Multiple credential access can be defined by using the following authentication methods:

1. PIN code

2. Biometrics

3. Cryptographic keys

• Only accessible data is shown to exist, making it possible to deny existence of some data on the card.
• No data is accessible to the technology provider.

Auditability

• The card’s code can be audited (Open Source).

• The card can store a log of each action performed with it: identity verification, data access, or any kind of transaction.

ID PASS has been designed to meet the needs of vulnerable populations and address the problems they are currently facing. It proposes a portable solution that offers similar if not better security features compared to a smartphone and only costs between $0.50 and $2.00. It is also easy to integrate with existing solutions as it provides an API for different operating systems (Android, Windows, Mac, Linux, etc.), blockchains (Ethereum, EOSIO, and Sovrin) and biometric hardware. Those APIs will make it possible to integrate with other solutions in a matter of days or even hours: Beneficiary Management Systems (OpenSRP, UNICEF’s Primero, WFP’s SCOPE), Digital Identity Systems (OpenCRVS, MOSIP) or Points of Service and Points of Sale.

ID PASS is meant to be as simple as possible to foster quick adoption by both issuers and end users.

At the end user level:

• Very simple for the user as it does not require literacy.

• Tailored for the harsh conditions found in the least developed countries.

At the Government, humanitarian organization, and Identity Verifier level:

• Provides a simple API to integrate with desktop solutions as well as Android applications.

• Does not require a central server.

• Works offline.

• Supports multiple identities and claims on a single smart card.

• Allows instant identity document issuance.

• Cost-effective registration process.

Interoperability and portability are at the core of ID PASS. This has guided our design to be based on open standards whenever possible, and when not, we make sure the solution is compatible with a range of alternatives (such as for the blockchain and the biometrics). Furthermore, the identity information is stored in a standard format (Verifiable Credentials) and can be moved to a different medium when needed. Lastly, the ID PASS data is stored on the card itself, owned by the holder—the company behind the technology does not hold any copies of the information.

We have faced connectivity, literacy, numeracy and linguistic challenges on many occasions and have designed ID PASS around the following constraints:

Lack of connectivity

• ID PASS’ API can create a cache of a trusted issuer public key.

• Registration can be done offline by creating identifiers before going offline or by post-creating them depending on the blockchain’s capabilities.

Low literacy and numeracy levels

• Biometrics match-on-card (fingerprint or iris) can be used as a substitute of a PIN code.

• Other sensitive information can further be protected by the issuing organization so that a limited set of partners can access it.

The SDG 16:9 set by the UN is to provide legal identity for all by 2030. Over the next decade, the challenges of identity, and specifically privacy, will be a major concern for governments and organizations worldwide. 

By being compatible with a wide range of systems and platforms through open APIs, and allowing to operate in places where there is no connectivity, we aim to make ID PASS the leading open source decentralized identity solution for organizations of all sizes, and thus maximize its impact on people's lives around the world. 

While we can’t name specific organizations due to non-disclosure agreements, we are currently working with some of the largest humanitarian organizations. We help these organizations define their needs and implement innovative solutions to help them meet their objectives.

Newlogic’s four founders are entrepreneurs with business and engineering backgrounds. In the past 5 years, Newlogic has been providing one of the world’s largest humanitarian organizations with solutions used to register more than 10 million beneficiaries, thus proving its ability to handle large-scale, global projects. In parallel, the team has been consistently contributing to and/or leading major commercial and non-commercial open source projects such as Django, eXo Platform, and XWiki.

With a recognized technical expertise and a deep understanding of the humanitarian sector, the team is well equipped to tackle the challenge of digital identity for the most vulnerable.

Newlogic, the company behind ID PASS, has been has been consistently growing and generating revenue for several years by providing software development services. A portion of the profit is set aside to fund the development of ID PASS.

Although ID PASS is open source, Newlogic will provide support, training, consulting services, certification programs and packaged solutions. In order to remain as accessible as possible to organizations of all sizes, we intend to charge either a one time licensing fee or a recurring fee per identity delivered. This makes it easier for the organization to start delivering ‘good identity’ using ID PASS, while providing the project with a steady source of revenue in the long term.

ID PASS is also always seeking new partners willing to donate time or money to improve the solution, develop new features, or finance new deployments.

With the submission of ID PASS to the Mission Billion Challenge, we aim to:

1. Have the opportunity to interact with and get feedback from experts at the World Bank and the judging panel.

2. Increase the visibility of ID PASS, reach more potential users and partners, obtain funding for upcoming pilot projects.

3. Seek integration with other complementary projects taking part in the challenge.

We identified three key barriers: general inertia in the field of identity, lack of concern from governments and humanitarian actors for privacy, and difficulty to physically reach the very people we are trying to help. 

To fight inertia we plan to follow the path laid out by other startups that tackled mature industries ripe for disruption. To increase concern for privacy, we plan to team up with other actors in the modern identity space. To reach vulnerable people, we will partner with the organizations with a strong field presence and integrate with their tools at no cost.